Many ways you can do this, first one came to my mind Navigate to Azure AD - Devices - All Devices - Export the devices to Excel - Filter results by Not Compliant and none for MDM. This will give you the idea of devices not managed by Intune. Then you can apply a Conditional Access to allow only Compliant Devices to access your tenant. You need to hand hold the users to register their devices depend if using hybrid or Azure AD registered.
I would go through the report you going to export and disable the access for the devices that not Compliant /not managed by intune.Check the activity column to have an idea of the stale devices. Without Conditional Access you need to keep doing this manually. CA is an essential security tool for transitioning to the cloud so you may need to consider it before moving workload to the cloud.
